Privacy Policy

1. Who we are

1.1 This privacy policy (the "Policy") explains how personal data is handled on the EvaCore platform at app.evacore.io (the "Platform") and on the website evacore.io (the "Website"). The Platform is a software-as-a-service product (B2B) that gives real-estate offices, brokers and developers an AI sales assistant, "Eva" ("Eva"), a shared inbox for WhatsApp and other channels, and customer-relationship and deal-management tools. "EvaCore" is the brand of the Platform and is not a legal entity.

1.2 Two companies operate EvaCore:

(a) Rafd Soft Trading Company (One-Person Company) («شركة رفد سوفت للتجارة – الموزع المعتمد لـ Eva core Inc.»), a single-person limited liability company incorporated in the Kingdom of Saudi Arabia, Unified National Number 7034175740, Abha ("Rafd Soft"), the authorised reseller of Eva core Inc. in the Kingdom, which sells Enterprise subscriptions to Customers in the Kingdom; e-mail saad@evacore.io; and

(b) Eva core Inc., a corporation incorporated under the laws of the State of Delaware, United States of America (Delaware File Number 10170131), 166 Geary Street, Suite 1500 #603, San Francisco, California 94108, United States of America; telephone +1 (424) 526-5747; e-mail saad@evacore.io, which develops, operates and hosts the Platform, operates the Website and sells the self-serve plans.

1.3 In this Policy "we" means the entity that is responsible in the situation concerned, as set out in clause 2. "Customer" means a business that subscribes to the Platform, "User" means an individual who uses the Platform on a Customer's behalf, and "Lead" means a person who contacts a Customer or is contacted by a Customer or by Eva on a Customer's behalf. "PDPL" means the Saudi Personal Data Protection Law (Royal Decree M/19 of 9/2/1443H, as amended by Royal Decree M/148 of 5/9/1444H), together with its Implementing Regulation and the Regulation on Personal Data Transfer outside the Kingdom. "SDAIA" means the Saudi Data and Artificial Intelligence Authority.

2. Who is responsible for which data

2.1 Website visitors, self-serve Customers and direct Customers. Eva core Inc. is the controller of the personal data that it collects about visitors to the Website, and of the account, contact and billing data of Customers that subscribe to a self-serve plan or contract with Eva core Inc. directly, and of their Users and representatives.

2.2 Enterprise Customers in the Kingdom. For the contact and billing data of an Enterprise Customer in the Kingdom and of its Users and representatives, Rafd Soft is the controller, for administering its agreement with the Customer, invoicing, accounting and tax. Eva core Inc. processes that data only on Rafd Soft's instructions, as its processor, to administer the Customer's account on the Platform.

2.3 Security logs and legal records. Eva core Inc. is an independent controller of the security and access logs of the Platform that it needs to protect the Platform, and of the records it must keep under the laws that apply to it.

2.4 Leads and clients of a Customer. For the personal data of a Customer's Leads and clients, the Customer (the real-estate office) is the controller. It decides why and how the data is processed, determines and documents the lawful basis for each person, and is responsible for informing its Leads, including that their conversations may be handled by an automated assistant. The Customer's subscription agreement with us is not the consent of, or a contract with, any Lead or client. For an Enterprise Customer in the Kingdom, Rafd Soft is the Customer's processor and Eva core Inc. is Rafd Soft's sub-processor. For any other Customer, Eva core Inc. is the Customer's processor. We process this data only on the Customer's instructions as given through its use of the Platform. If you are a Lead and want to exercise your rights, contact the office you dealt with first; we will help it respond.

3. The personal data we handle

3.1 Account and contact data: name, e-mail address, telephone number, job title, the name of the office, sign-in credentials (passwords are stored hashed), two-step verification settings and role.

3.2 Messages and channel data: for each channel a Customer connects (WhatsApp, Instagram, TikTok, X and others), the text of incoming and outgoing messages, the sender's telephone number or account identifier and display name, delivery status, and any images, voice notes, documents or files sent in the conversation.

3.3 Voice notes and documents: voice notes are converted to text so that Eva can reply; text is extracted from documents and images that are sent or uploaded.

3.4 Customer-relationship data: Leads, property listings, notes, appointments, assignments and reports entered in the Platform or generated by it.

3.5 Ad-form data: if a Customer connects its Snapchat ads account, the lead forms completed there (name, telephone number, e-mail address if requested, answers, consents, and ad, campaign and form identifiers).

3.6 Financing pre-qualification: if a Lead uses the financing calculator, salary, sector of employment, monthly obligations, age, housing-support status, down payment and the estimate; these are stored in the Customer's record of that Lead. Where a Customer uploads deal-file documents for financing, they may include identity copies, salary certificates and bank statements; the Customer decides whether to upload them and is responsible for their lawful basis.

3.7 Reservations and payments: the reserved unit, deposit amount, payment status and reference, payment schedules, uploaded receipts and handover dates. Card data is entered by the payer directly with the payment provider and does not reach us.

3.8 Calls: if a Customer switches on Eva's calls, the Lead's number, call time, outcome, recording where enabled, and transcript.

3.9 Billing data: billing contact details, the plan, invoices and payment status.

3.10 Usage, device and log data: sign-in records, IP address, pages viewed and features used, and error reports. Web addresses are redacted before they reach error monitoring or analytics.

3.11 Monitored public posts: if a Customer switches on X monitoring, the text, author name and public handle of public posts from the last 7 days that match search terms the Customer has saved.

3.12 Calendar connection data: if a User connects a Google or Microsoft 365 calendar, the start and end times of events, a hash of the calendar identifier, its time zone, identifiers of the placeholder viewing events, and encrypted access tokens (clause 5A).

4. Why we use personal data and our legal bases

4.1 We use personal data for the purposes below. Where we act as controller, the basis under the PDPL is the data subject's consent where consent is required, and otherwise the performance of an agreement to which the data subject is a party or which is concluded in the data subject's interest, compliance with a legal obligation, or the controller's legitimate interests where they do not harm the data subject's rights.

4.2 We do not sell personal data and do not use Customer data or Leads' data to train AI models.

4.3 Where we rely on consent, you may withdraw it at any time as described in clause 11, without affecting processing already carried out.

5. WhatsApp and other channels

5.1 Eva core Inc. connects the Platform to WhatsApp, Instagram, TikTok and X through the connection provider Zernio, and to WhatsApp Business through Meta's platform. When a Customer connects its own number or account, we process telephone numbers, display names, message content, delivery status and use of pre-approved message formats to run the automated reply and manage conversations on the Customer's behalf.

5.2 If the Customer uses its number both in the WhatsApp Business app and on the Platform, a copy of messages the Customer sends from its phone may reach us from Meta through Zernio, together with the earlier conversation history on that number if the Customer approved sharing it when connecting, so that they can be shown in the inbox.

5.3 We process these messages as processor; the Customer remains the controller of its Leads' data, including responsibility for informing them that their conversations are handled through an automated assistant.

5.4 Deleting a conversation on the Platform does not delete it from the WhatsApp application on a device or from Meta's records, which are governed by the Channel Providers' own policies.

5A. Calendar connections

5A.1 A User may choose to connect the User's own Google Calendar or Microsoft 365 calendar to the Platform. Connecting is optional and happens only after the User consents on the provider's own consent screen. It gives the Platform read and write access to the User's primary calendar only. Only the connecting User can manage the connection, and a Customer's administrators cannot read the User's access tokens.

5A.2 We use this access only to provide these user-facing features:

(a) to read the start and end times of events on the primary calendar, from the previous day to 100 days ahead, so that a Lead is not offered a viewing time when the User is busy; and

(b) to create, update and delete the placeholder event that the Platform creates in that calendar for each viewing booked on the Platform. The placeholder title is the fixed text "معاينة · Viewing". It carries the times only: no Lead name, telephone number, notes or attendees, and no invitation is sent.

5A.3 We store the event start and end times, a one-way hash of the calendar identifier, the calendar's time zone, the provider's identifier and version tag for each placeholder event, and the access and refresh tokens in encrypted form. We do not store the titles, descriptions, attendees or locations of the User's other events. Eva, the automated assistant, receives only the resulting free viewing times, never the events or the busy times.

5A.4 We do not sell calendar data, and we do not use or transfer it for advertising, interest-based advertising, data brokers, information resellers, or to determine credit-worthiness or for lending. We do not use it to develop, improve or train generalized AI or machine-learning models. The only recipient of calendar data is our hosting provider, Google Cloud (clause 6.1), which hosts the Platform for us. The User's own calendar provider (Google or Microsoft) receives the requests described in clause 5A.2.

5A.5 We do not transfer calendar data to anyone else, and no person at EvaCore reads it, except: (a) with the User's specific affirmative consent; (b) where necessary for security, such as investigating abuse; (c) where the law requires; or (d) in aggregated and anonymised form for internal operations. For information received from Google, a transfer to a successor on a sale or merger of the business also requires the User's prior explicit consent.

5A.6 A User may disconnect at any time on the Platform's calendar page. Disconnecting immediately deletes the stored tokens, busy times, calendar details and event mappings. It does not delete placeholder events already created in the external calendar, which the User can delete there, and it does not revoke the permission granted to EvaCore at the provider. To revoke it, use https://myaccount.google.com/permissions (Google), https://account.live.com/consent/Manage (Microsoft personal account) or https://myapps.microsoft.com (Microsoft work or school account).

5A.7 EvaCore's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy.

6. Who receives personal data

6.1 We share personal data only with the recipients below, each used for the purpose stated. "When used" shows whether a recipient is used for every Customer or only when a feature is switched on. The locations stated are those recorded in our transfer register and transfer risk assessment, and a route whose countries are not recorded is disabled as clause 7.2 states. We will update this list before a new recipient starts to process personal data, and we notify Customers of changes as their agreement provides.

6.2 Rafd Soft and Eva core Inc. share personal data with each other as described in clause 2. We also disclose personal data to courts, regulators and other authorities when the law requires, and to professional advisers bound by confidentiality. If the business is transferred, personal data may pass to the successor on the terms of this Policy.

6.3 Snapchat's processing of data is governed by Snap's own privacy policy.

7. Transfers outside the Kingdom

7.1 The Platform's application, database and files are hosted on Google Cloud in region us-central1 (Iowa, United States of America), and database backups are stored in Google's us multi-region. AI processing is performed by providers outside the Kingdom: OpenRouter and OpenAI in the United States, Google Gemini on Google's infrastructure in the United States and globally. Several channels and other recipients in clause 6 are also outside the Kingdom. Personal data processed on the Platform is therefore transferred outside the Kingdom.

7.2 Transfers are made under article 29 of the PDPL and the Regulation on Personal Data Transfer outside the Kingdom. Each transfer relies on an appropriate safeguard recognised by that Regulation: the Standard Contractual Clauses issued by SDAIA between Rafd Soft and Eva core Inc. for Enterprise Customers in the Kingdom; the Standard Contractual Clauses incorporated in the terms between a Customer and Eva core Inc.; and, for each other recipient outside the Kingdom, the safeguard recorded for it in our transfer register. Transfers are permitted only through the verified routes recorded in our transfer register. A route whose countries, safeguard or required assessment are incomplete is disabled until they are completed, and this Policy identifies the recipients and countries of the routes that are enabled. Our transfer risk assessment covers the data and purposes, the laws and practices of the destination countries (including laws of the United States that may require disclosure of data to public authorities), the safeguards applied and the remaining risk to data subjects. We review it at least once a year and before a new recipient outside the Kingdom is added, and no transfer to a new recipient begins before its assessment is complete. Our transfer register identifies each recipient, its destination countries, the purpose, the categories of data and the transfer mechanism, and clause 6 reflects that register. We limit what each recipient receives to what is necessary, as stated in clause 6.

7.3 By using the Platform a Customer, as controller of its Leads' data, instructs and authorises these transfers and is responsible for any consent that the law requires from its Leads.

7.4 DeepSeek is not used for personal data, and is never used for Enterprise accounts. Hosting of the Platform's application, database and files in the Kingdom is not currently available; it may be provided to an Enterprise Customer only under a separately signed deployment schedule, and AI processing by the providers in clause 6 would remain outside the Kingdom.

8. How long we keep personal data

9. Cookies and analytics

9.1 We use cookies and similar technologies that are strictly necessary to keep you signed in, secure your session and remember your language. They do not need consent.

9.2 We use self-hosted Umami for cookie-free visitor and product analytics. It records page paths, referral origins, campaign labels, approximate country, device type and selected product events (plan and team-size band only). We do not send names, e-mail addresses, phone numbers or user or office identifiers in these events. Sensitive credential-bearing pages are excluded and other query parameters and page titles are removed. Umami does not set analytics cookies; the server still receives network metadata such as IP addresses to process requests. Umami is software hosted by us, not an additional analytics processor. Do Not Track is respected. The cookie preferences control continues to govern optional advertising tags, separately from these cookie-free analytics.

9.3 We use error monitoring (Sentry) to keep the Platform secure and working; web addresses are redacted before they are sent.

10. Security

10.1 We apply security measures appropriate to the risk, including encryption in transit (TLS) and at rest, isolation of each Customer's data from others, role-based access, two-step verification that a Customer can require for its whole office, hashed passwords, rate limiting, audit history of security-relevant actions, and secret management for integration credentials. Access to production systems is limited to authorised personnel with two-step verification.

10.2 No system is completely secure. In the event of a personal-data breach affecting data that we process for a Customer, we notify the Customer without undue delay, and the Customer, as controller, notifies SDAIA and data subjects where the PDPL requires. For a breach affecting personal data for which Rafd Soft or Eva core Inc. is the controller, that entity notifies SDAIA and the affected data subjects where the PDPL requires. Report security concerns to security@in.evacore.io.

11. Your rights

11.1 Under the PDPL (including article 4) you have the right to: (a) be informed about the collection and use of your personal data; (b) access your personal data; (c) obtain a copy of your personal data in a readable and clear format; (d) request correction of inaccurate or incomplete personal data; (e) request destruction of your personal data when it is no longer needed for the purpose for which it was collected, unless a legal ground allows us to keep it; and (f) withdraw your consent at any time where processing is based on consent.

11.2 How to exercise your rights. Write to privacy@in.evacore.io, stating your name, the right you wish to exercise and how to reach you. We may ask you to prove your identity. If your data is held for a Customer as controller (such as a Lead of a real-estate office), we will pass your request to that Customer within 3 Business Days (Sunday to Thursday, excluding official public holidays in the Kingdom) and help it respond.

11.3 Response time. We or the controller will respond within 30 days of receiving a verifiable request. We may refuse or limit a request where the law allows, and we will tell you why.

11.4 Complaint. If you believe your personal data has been processed in breach of the PDPL, you may complain to SDAIA, the competent authority, in addition to contacting us.

12. Children

12.1 The Platform and the Website are intended for businesses and for people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to privacy@in.evacore.io and we will delete it.

13. Automated assistant

13.1 Eva replies to Leads automatically on the channels where a Customer has switched it on. Eva's replies are generated by AI models and may contain errors. The Customer can pause Eva or take over a conversation at any time. A Lead may ask the Customer to speak to a person.

13.2 Where a User has connected a calendar (clause 5A), Eva receives only the resulting free viewing times, never the User's calendar events.

14. Changes to this Policy

14.1 We may update this Policy. We will publish the updated Policy at evacore.io/privacy and notify Customers of material changes by e-mail or by a notice on the Platform before the change takes effect and before any new processing that it describes begins. Where the PDPL requires the consent of a data subject for new processing, we will obtain that consent before the processing begins.

15. Language

15.1 This Policy is published in Arabic and English. If the two texts differ, the Arabic text prevails.

16. Contact

16.1 Privacy requests: privacy@in.evacore.io. Security reports: security@in.evacore.io. General and legal notices: saad@evacore.io.

16.2 Rafd Soft Trading Company (One-Person Company), Unified National Number 7034175740, 4000 Prince Mohammed bin Abdulaziz Road 7387, Abha 62527, Kingdom of Saudi Arabia. Eva core Inc., 166 Geary Street, Suite 1500 #603, San Francisco, California 94108, United States of America; +1 (424) 526-5747.

16.3 The privacy contact of the entity responsible under clause 2 is privacy@in.evacore.io. Where the PDPL requires a data protection officer to be appointed for the processing described in this Policy, that officer's contact details will be published in this clause before that processing begins.